IN THE CLAIMS: 



Please amend the claims as follows. 

1. (Canceled) 

2. (Previously Presented) The method of claim 5, further comprising generating a 
visual map of the IT system, the visual map including a depiction of at least one of the 
discovered components and the at least one dependency between two or more of the discovered 
components. 

3. (Previously Presented) The method of claim 2, wherein the visual map 
includes tracked changes to at least one of the discovered components. 

4. (Previously Presented) The method of claim 5, wherein at least one of the 
discovered components is an application. 

5. (Currently Amended) A method for collecting information on components in an 
information technology (IT) system, comprising: 

creating a plurality of component fingerprints, wherein the plurality of component 
fingerprints includes a fingerprint for a first component, wherein creating the fingerprint for the 
first component comprises identifying a plurality of attributes of the first component and 
selecting one or more, but not all, of the plurality of attributes as the fingerprint for the first 
component; 

automatically discovering the existence of at least one of the a plurality of components in 
the IT an information technology (IT) system using the plurality of component fingerprints, 
wherein the discovered components include the first component, wherein automatically 
discovering the existence of the first component comprises: byr 

receiving a plurality of event messages indicating a plurality of real-time events 
that occur in the IT system, wherein each event message matches a respective attribute of the 
fingerprint for the first component; and 
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determining that event messages matching every attribute of the fingerprint for the 
first component have been received; 

receiving one or more real time messages corresponding to one or more occurrences in 
the IT system, wherein the real time messages include event information relating to one or more 
components, including a first component; 

comparing at least the first component to one or more fingerprints, wherein each 
fingerprint corresponds to a known component and includes one or more attributes that are a 
subset of attributes in a model of the known component; and 

based on said comparing, matching one or more components with one or more 
fingerprints; 

wherein the method further comprises: 

automatically determining at least one dependency between two or more of the 
discovered components; and 

tracking changes to at least one of the discovered components and the at least one 
dependency between two or more of the discovered components. 

6. (Currently Amended) The method of claim 5, wherein the plurality of event 
messages includes a first event message indicating a first real-time event indicated occurrence is 
selected from the following real-time events: one or more of a file creation, a file deletion, and a 
file modification. 

7. (Currently Amended) The method of claim 5, wherein the plurality of event 
messages includes a first event message indicating a first real-time event indicated occurrence is 
selected from the following real-time events: one or more of a registry key creation, a registry 
key deletion, and a registry key modification. 

8. (Currently Amended) The method of claim 5, wherein the plurality of event 
messages includes a first event message indicating indicated occurrence is information 
regarding detection of a particular element of the first component in the IT system. 
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9. (Currently Amended) The method of claim 5, further comprising; 

after discovering the existence of the first component, receiving a subsequent event 
message indicating that an element of the first component was deleted; and 

indicating that a particular the first component has been damaged if the indicated 
occurrence is a deletion and at least one of the attributes of the fingerprint is no longer matched 
by the components in the IT system in response to the subsequent event message . 

10. (Currently Amended) The method of claim 5, further comprising! 

after discovering the existence of the first component, receiving one or more subsequent 
event messages indicating that one or more elements of the first component were deleted; and 

indicating that a particular the first component has been uninstalled if the indicated 
occurrence is a deletion and all of the attributes of a minimum set of the fingerprint are no 
longer matched by the components in the FT system in response to the one or more subsequent 
event messages . 

1 1 . (Previously Presented) The method of claim 5, wherein the at least one 
dependency is selected from the group consisting of shared library usage, network usage, and 
containment dependencies. 

12. (Previously Presented) The method of claim 5, further comprising: 

generating a component discovered message upon the discoveiy of one of the 
components; 

retrieving a list of elements to track the discovered component; and using 
the list of elements to track changes to the discovered component. 
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13. (Currently Amended) A computer-readable medium storing program instructions 
that are computer executable to implement a method comprising: 

an agent for collecting information on components in an information technology (IT) 
system, the agent residing on a computer in the IT system, wherein the program instructions are 
executable to implement: 

identifying a plurality of attributes of a first component and listing one or more, but not 
all, of the plurality of attributes in a fingerprint for the first component; 

an observer module to detect detecting a plurality of real-time events event information 
about elements of the computer in an information technology (IT) system, wherein each event 
matches a respective attribute listed in the fingerprint for the first component ; and 

the observer module sending a respective event message to an analysis module in 
response to each of the plurality of real-time events; 

the analysis module accumulating the event messages and analyzing the event messages 
in order to determine that events matching every attribute listed in the fingerprint for the first 
component have occurred in the IT system; and 

the analysis module indicating that the first component exists in the IT system in response 
to said determining that events matching every attribute listed in the fingerprint for the first 
component have occurred in the IT system. 

an analysis module to process the real time event information, the analysis module 
including: (a) component discovery rules to process real time event information and match event 
information with elements of one or more fingerprints of known components using an 
accumulator to discover one or more components, wherein each fingerprint corresponds to a 
known component and includes one or more attributes that are a subset of attributes in a model 
of the known component, and (b) dependency discoveiy rules to detect relationships between 
discovered components of the IT system. 
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14. (Currently Amended) A system for collecting information on components in an 
information technology (IT) system, comprising: 

means for creating a plurality of component fingerprints, wherein the plurality of 
component fingerprints includes a fingerprint for a first component, wherein creating the 
fingerprint for the first component comprises identifying a plurality of attributes of the first 
component and selecting one or more, but not all, of the plurality of attributes as the fingerprint 
for the first component; 

means for automatically discovering the existence of at least one of the a plurality of 
components in the IT an information technology (IT) system using the plurality of component 
fingerprints, wherein the discovered components include the first component, wherein 
automatically discovering the existence of the first component comprises: byf 

receiving a plurality of event messages indicating a plurality of real-time events 
that occur in the IT system, wherein each event message matches a respective attribute of the 
fingerprint for the first component; and 

determining that event messages matching every attribute of the fingerprint for the 
first component have been received; 

receiving one or more real time messages corresponding to one or more occurrences in 
the IT system, wherein the real time messages includ e event information regarding an occurrence 
in the IT system, the occurrence relating to a first component; 

comparing at least the first component to one or more fingerprints, wherein each 
fingerprint corresponds to a known component and includes one or more attributes that are a 
subset of attributes in a model of the known component; and 

based on said comparing, matching one or more components with one or more 
fingerprints; 

means for automatically determining at least one dependency between two or more of the 
discovered components; and 
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means for tracking changes to at least one of the discovered components and the at 
least one dependency between two or more of the discovered components. 

1 5 . (Currently Amended) An apparatus for collecting information on components in 
an information technology (IT) system, comprising: 

a memory storing [[a]] program instructions ; 

a processor in communication with the memory; in which the processor is directed by 
the program instructions to: 

create a plurality of component fingerprints, wherein the plurality of component 
fingerprints includes a fingerprint for a first component, wherein creating the fingerprint for the 
first component comprises identifying a plurality of attributes of the first component and 
selecting one or more, but not all, of the plurality of attributes as the fingerprint for the first 
component; 

automatically discover the existence of at least one of the a plurality of components in 
the IT an information technology (IT) system using the plurality of component fingerprints, 
wherein the discovered components include the first component, wherein automatically 
discovering the existence of the first component comprises: byf 

receiving a plurality of event messages indicating a plurality of real-time events 
that occur in the IT system, wherein each event message matches a respective attribute of the 
fingerprint for the first component; and 

determining that event messages matching every attribute of the fingerprint for the 
first component have been received; 

receiving one or more real time messages corresponding to one or more occurrences in 
the IT system, wherein the real time messages include event information regarding an occurrence 
in the IT system, the occurrence relating to a first component; 
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comparing at least the first component to one or more fingerprints, wherein each 
fingerprint corresponds to a known component and includes one or more attributes that are a 
subset of attributes in a model of the known component; and 

based on said comparing, matching one or more components with one or more 

automatically determine at least one dependency between two or more of the discovered 
components; and 

track changes to at least one of the discovered components and the at least one 
dependency between two or more of the discovered components. 

16. (Currently Amended) A method for discovering components in an information 
technology (IT) system, comprising: 

creating a fingerprint for a first component, wherein creating the fingerprint for the first 
component comprises identifying a plurality of attributes of the first component and selecting one 
or more, but not all, of the plurality of attributes as the fingerprint for the first component; 

creating a subfingerprint for a refinement of the first component, wherein the 
subfingerprint for the refinement of the first component includes one or more attributes of the 
refinement of the first component; 

automatically discovering the first component in an information technology (IT) system, 
wherein automatically discovering the first component comprises: 

receiving a plurality of event messages indicating a plurality of real-time events 
that occur in the IT system, wherein each event message matches a respective attribute of the 
fingerprint for the first component; and 

determining that event messages matching every attribute of the fingerprint for the 
first component have been received; 

wherein the method further comprises: 

in response to discovering the first component, performing one or more commands to 
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obtain information regarding the first component; and 

automatically discovering the refinement of the first component in the IT system by 
matching the information regarding the first component to the one or more attributes of the 
refinement of the first component included in the subfingerprint for the refinement of the first 
component- 
receiving event information regarding an occurrence in the IT system, the occurrence 
relating to a first component; 

comparing at least the first component to at least one fingerprint, wherein the fingerprint 
includes one or more attributes that are a subset of attributes in a model of a known component; 

if any of the compared components match substantially all of the attributes of the 
fingerprint, using a subfingerprint of a refinement of the known component to discover the 
existence of a second component that corresponds to the refinement of the known component. 

17. (Currently Amended) The method of claim 16, wherein the refinement of the 
known first component is a particular version of the known first componen t, wherein 
discovering the refinement of the first component comprises discovering that the particular 
version of the first component exists in the IT system . 

18. (Currently Amended) The method of claim 16, wherein the refinement of the 
known first component is an optional piece of the known first component , wherein discovering 
the refinement of the first component comprises discovering that the optional piece of the first 
component exists in the IT system . 

19-21. (Canceled) 

22. (Currently Amended) The method of claim [[21]] 16, wherein the plurality of 
event messages include one or more event messages indicating one or more real-time events 
associated with low level items are selected from one or more of files, registry settings, and 
database schemas. 
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23. (Currently Amended) A computer-readable medium for discovering 
components in an information technology (IT) system, the computer readable medium storing 
instructions that direct a microprocessor to: 

create a fingerprint for a first component, wherein creating the fingerprint for the first 
component comprises identifying a plurality of attributes of the first component and selecting oen 
or more, but not all, of the plurality of attributes as the fingerprint for the first component; 

create a subfingerprint for a refinement of the first component, wherein the subfingerprint 
for the refinement of the first component includes one or more attributes of the refinement of the 
first component; 

automatically discover the first component in an information technology (IT) system, 
wherein automatically discovering the first component comprises: 

receiving a plurality of event messages indicating a plurality of real-time events 
that occur in the IT system, wherein each event message matches a respective attribute of the 
fingerprint for the first component; and 

determining that event messages matching every attribute of the fingerprint for the 
first component have been received; 

in response to discovering the first component, perform one or more commands to obtain 
information regarding the first component; and 

automatically discover the refinement of the first component in the IT system by 
matching the information regarding the first component to the one or more attributes of the 
refinement of the first component included in the subfingerprint for the refinement of the first 
component- 
receive event information regarding an occurrence in the IT system, the occurrence 
relating to a first component; 

compare at least the first component to at least one fingerprint, wherein the fingerprint 
includes one or more attributes that are a subset of attributes in a model of a known 
component; and 
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if any of the compared components match substantially all of the attributes of the 
fingerprint, using a subfingerprint of a refinement of the known component to discover the 
existence of a second component that corresponds to the refinement of the known component. 
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24. (Currently Amended) An apparatus for discovering components in an 
information technology (IT) system, comprising: 

a memory storing [[a]] program instructions ; 

a processor in communication with the memory; in which the processor is directed by 
the program instructions to: 

create a fingerprint for a first component, wherein creating the fingerprint for the first 
component comprises identifying a plurality of attributes of the first component and selecting one 
or more, but not all, of the plurality of attributes as the fingerprint for the first component; 

create a subfingerprint for a refinement of the first component, wherein the subfingerprint 
for the refinement of the first component includes one or more attributes of the refinement of the 
first component; 

automatically discover the first component in an information technology (IT) system, 
wherein automatically discovering the first component comprises: 

receiving a plurality of event messages indicating a plurality of real-time events 
that occur in the IT system, wherein each event message matches a respective attribute of the 
fingerprint for the first component; and 

determining that event messages matching every attribute of the fingerprint for the 
first component have been received; 

in response to discovering the first component, perform one or more commands to obtain 
information regarding the first component; and 

automatically discover the refinement of the first component in the IT system by 
matching the information regarding the first component to the one or more attributes of the 
refinement of the first component included in the subfingerprint for the refinement of the first 
component- 
receive event information regarding an occurrence in the IT system, the occurrence 
relating to a first component; 
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compare at least the first component to at least one fingerprint, wherein the fingerprint 
includes one or more attributes that are a subset of attributes in a model of a known 
component; and 

if any of the compared components match substantially all of the attributes of the 
fingerprint, using a subfingerprint of a refinement of the known component to discover the 
existence of a'second component that corresponds to the refinement of the known 
component. 

25-29. (Canceled) 
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30. (Currently Amended) A method for determining dependencies between 
components in an information technology (IT) system, comprising: 

automatically discovering a first component and a second component at least two 
components in the IT system , wherein automatically discovering the first component comprises 
automatically discovering that one or more elements of the first component are present in the IT 
system, wherein automatically discovering the second component comprises automatically 
discovering that one or more elements of the second component are present in the IT system ; 

monitoring the usage of resources by the discovered first and second components in the 
IT system by receiving real-time messages; 

if a resource is used by one or more of the discovered components, generating a message 
indicating the use of that resource; 

accumulating each message indicating the use of one of the resources by one of the 
discovered components ; 

in response to receiving a first real-time message indicating that the first component uses 
a particular resource, sending a first resource usage message to an accumulator, wherein the first 
resource usage message indicates that the first component uses the particular resource; 

in response to receiving a second real-time message indicating that the second 
component uses the particular resource, sending a second resource usage message to the 
accumulator, wherein the second resource usage message indicates that the second component 
uses the particular resource; 

if the accumulated messages indicate that at least two of the discovered components 
use the same resource, then the accumulator indicating that a first dependency between these 
components has been detected the first component and the second component exists in 
response to determining that the first and second resource usage messages indicate that the 
first component and the second component both use the particular resource ; and 

determining a direction type of the first dependency between the indicated components 
first component and the second component . 
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31. (Canceled) 



32. (Currently Amended) The method of claim 30, wherein the first component is 
selected from the group consisting of an application, a network connection endpoint, and a 
server. 

33. (Currently Amended) The method of claim 32, 

wherein the particular resource is a particular network port; 

wherein at least one the first resource usage message indicates that the first 
component uses the particular network port and wherein the second resource usage message 
indicates that the second component uses the particular network port, a network outbound 
connection by one of the two discovered components. 

34. (Canceled) 

35. (Currently Amended) The method of claim 32, 
wherein the particular resource is a particular file; 

wherein at least one the first resource usage message indicates that the first component 
uses a use of a the particular file and wherein the second resource usage message indicates that 
the second component uses the particular file, by one of the two discovered components. 

36. (Currently Amended) The method of claim 30, further comprising tracking 
changes to the first dependency between the two discovered components first component and 
the second component . 

37. (Currently Amended) The method of claim 30, wherein determining the type of 
the first dependency comprises determining that the first dependency is a containment 
dependency. 
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38. (Currently Amended) The method of claim 30, wherein determining the 
type of the first dependency comprises determining that the first dependency is a network 
dependency. 

39. (Currently Amended) The method of claim 30, wherein determining the type of 
the first dependency comprises determining that the first dependency is a shared usage 
dependency. 

40. (Currently Amended) An apparatus for determining dependencies between 
components in an information technology (FT) system, comprising: 

a memory storing [[a]] program instructions ; 

a processor in communication with the memory; in which the processor is directed by 
the program instructions to implement a method comprising : 

automatically discover discovering a first component and a second component at least 
two components in an information technology (IT) the FT system , wherein automatically 
discovering the first component comprises automatically discovering that one or more elements 
of the first component are present in the IT system, wherein automatically discovering the second 
component comprises automatically discovering that one or more elements of the second 
component are present in the IT system ; 

monitor the usage of resources by the discovered first and second components in 
the IT system by receiving real-time messages; 

if a resource is used by one or more of the discovered components, generating a 
message indicating the use of that resource; 

accumulate each message indicating the use of one of the resources by one of the two 
components; 

in response to receiving a first real-time message indicating that the first component uses 
a particular resource, sending a first resource usage message to an accumulator, wherein the first 
resource usage message indicates that the first component uses the particular resource; 
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in response to receiving a second real-time message indicating that the second 
component uses the particular resource, sending a second resource usage message to the 
accumulator, wherein the second resource usage message indicates that the second component 
uses the particular resource; 

if the accumulated messages indicate that at least two of the discovered components 
use the same resource, then the accumulator indicating that a first dependency between these 
components has been detected the first component and the second component exists in 
response to detemiining that the first and second resource usage messages indicate that the 
first component and the second component both use the particular resource ; and 

determine detemiining a direction type of the dependency between the indicated 
components first component and the second component . 

41-44. (Canceled) 
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